Show HN: Interactive Ansible Tutorial - <AUTHOR> https://github.com/turkenh/ansible-interactive-tutorial <comment><USER2> I wish there was a server provisioning "library" written in an ML-ish language.

The trouble with even a simple, well-made tool like Ansible is its dynamic DSL. The YAML file is essentially code, but modules like "file" and "apt" written as configuration entries give a declarative feel to it. But they are just procedures that strive to be idempotent, and its YAML file is just a series of procedure calls, sprinkled with some facility for organizing hierarchies and sharing code between them.

YAML the format is also not a great way to encode systems data. Thankfully Ansible has documented the gotchas with its space-indentation and need for explicit quoting in [http://docs.ansible.com/ansible/latest/YAMLSyntax.html#gotch...](http://docs.ansible.com/ansible/latest/YAMLSyntax.html#gotchas). But that is just an attempt to band-aid over the unsuitability of YAML for this purpose.

Chef's configuration on the other hand can be done in Ruby, but you're still constrained to its DSLs. The shape and structure of Chef's objects can only gleaned by reading reams of documentation, and worse, by running the cookbooks with debug statements.

The problem is compounded when you upgrade these tools and things stop working silently. The community solution for this unsurprisingly is unit tests. I'm still grappling with that idea.

But what if we could write our own provisioning code in Haskell or OCaml/Reason, with library functions that help install packages, returns errors in neat sum types which we can confidently handle and doesn't leave us to worry about the known unknowns that we haven't enumerated and handled, and a compiler with exhaustive pattern matching that helpfully tells us about all the record types and their structure within a fast edit-compile cycle, ...

<comment><USER3> >The YAML file is essentially code

YAML is not turing complete and is hence not "code". That is a large part of what makes ansible such a powerful tool - it enforces a strict separation of concerns between the definition of server configuration and its execution and keeps one in a language that is deliberately _not able_ to be made more complex than is needed, is thus kept readable and straightforward to maintain.

By contrast, turing complete languages are veritable _magnets_ for technical debt, which is why a bad chef playbook will always be worse than a bad ansible playbook. Haskell, being turing complete, would suffer the same issue albeit not to the same degree as ruby.

>YAML the format is also not a great way to encode systems data. Thankfully Ansible has documented the gotchas with its space-indentation and need for explicit quoting in [http://docs.ansible.com/ansible/latest/YAMLSyntax.html#gotch...](http://docs.ansible.com/ansible/latest/YAMLSyntax.html#gotch...). But that is just an attempt to band-aid over the unsuitability of YAML for this purpose.

YAML has a few oblique gotchas but they don't affect the fundamental suitability of it for this purpose. Once you get used to it, space indentation becomes a feature, not a bug.

<comment><USER2> Any sufficiently complicated configuration language contains an ad hoc, informally-specified, bug-ridden, slow implementation of a Turing complete programming language.

Ansible playbooks have variables, loops, conditionals, scoping rules, inheritance, and you can even extend it by writing custom modules in Python, which is a Turing complete language.

The problem with not using a real programming language when you're trying to essentially "program" is that you're expressing complex programs without any of the abstractions and tooling support that a real language has.

Despite all that I like Ansible's constrained format and the resulting simplicity compared to Chef. But I think we can take those design aesthetics and apply it in a statically typed library and maybe get something more sturdy.

<comment><USER3> >Ansible playbooks have variables, loops, conditionals, scoping rules, inheritance

As far as I am aware, variables, scoping rules and inheritance don't imply turing completeness and the way it does loops and conditionals could really more be characterized as configuration for loops/conditionals further down the stack (e.g. as seen here [http://docs.ansible.com/ansible/latest/playbooks_loops.html#...](http://docs.ansible.com/ansible/latest/playbooks_loops.html#loops- and-includes-in-2-0) )

>you can even extend it by writing custom modules in Python, which is a Turing complete language.

Yes, the idea is that you have the power to break into a (good) turing complete language when it is necessary but you can keep that code - and by extension _the technical debt it would attract_ \- to an absolute minimum. I've personally never felt the need to write a custom module in python when using ansible despite using it a lot, so for me, minimum is zero. I'm sure I'm not alone either.

>The problem with not using a real programming language when you're trying to essentially "program" is that you're expressing complex programs without any of the abstractions and tooling support that a real language has.

Yes, this is a problem if you're trying to work within a problem space that is not heavily constrained. If almost every time I used ansible I felt the need to write a python module to do almost everything I would agree that it is a fundamentally unsuitable task. I feel this issue when writing _build scripts_ which I think absolutely have to be kept turing complete, but never server orchestration.

<comment><USER4> > As far as I am aware, variables, scoping rules and inheritance don't imply > turing completeness and the way it does loops and conditionals could really > more be characterized as configuration for loops/conditionals further down > the stack (e.g. as seen here > [http://docs.ansible.com/ansible/latest/playbooks_loops.html#...](http://docs.ansible.com/ansible/latest/playbooks_loops.html#..). > )

Then what does _imply_ turing completeness?

According to the wikipedia article [1]:

"To show that something is Turing complete, it is enough to show that it can be used to simulate some Turing complete system. For example, an imperative language is Turing complete if it has conditional branching (e.g., "if" and "goto" statements, or a "branch if zero" instruction; see one instruction set computer) and the ability to change an arbitrary amount of memory (e.g., the ability to maintain an arbitrary number of variables). Since this is almost always the case, most if not all imperative languages are Turing complete if the limitations of finite memory are ignored."

[1] [https://en.wikipedia.org/wiki/Turing_completeness](https://en.wikipedia.org/wiki/Turing_completeness)

<comment><USER3> >Then what does imply turing completeness?

If it did arbitrary branching and if you could mutate a variable and then reuse it later on in a playbook.

<comment><USER5> The branching is a given. Variable mutation is totally possible with set_fact.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> A couple years ago I was working at a start-up on a team of about 3 developers. I was 20 years old and knew nothing about configuration management, but we needed it, so I bought a book ("x for devops" \- trying not to advertise), and got an automation pipeline in place that got the job done.

Cannot stress enough to new developers how you should have one of Ansible, Puppet, etc., framework under your belt to improve your ability to build software products. I'd recommend picking one that works equally good with old legacy systems, rather then just whatever is new like Kubernetes, because it will seriously broaden your career options and make you an asset to almost every software company.

EDIT: to clarify, k8s can obviously be used with legacy software applications. But the idea was that if you get hired by $some_old_PHP_shop throwing Ansible into the mix may have significantly less friction then convincing whoever is in charge to start maintaining k8s clusters.

<comment><USER7> "hired by $some_old_PHP_shop throwing Ansible into the mix"

Wholeheartedly agree. Got brought on board and Ansible was the first tool I reached for (there was previously nothing like this in place). The new tech is great, but something more broad in scope that can work with different kinds of systems can really come in handy if you're not working on new tech or greenfield projects.

</comment></comment><comment><USER8> OK, have to say this is pretty cool. Reading about how to do something is good, but ephemeral. Applying what you are learning (and making mistakes and figure out what went wrong) is a far better way to learn. Kudos to the author of this tutorial.

</comment><comment><USER9> For me the hardest part about Ansible was getting the ssh setup correct to connect to a remote machine. Having a quick browse of this tutorial I can't see much about that (maybe I missed it). That would be useful if you plan to update the tutorial.

<comment><USER10> As far as I know all you have to do is configure your ~/.ssh/config properly, and then use the hostnames set there. Same as regular old OpenSSH.

Just don't opt into the Paramiko control scheme, which isn't used by default except on RHEL6 anyway.

You can also set ssh_args in the config file to enable ControlMaster, etc. [http://docs.ansible.com/ansible/latest/intro_configuration.h...](http://docs.ansible.com/ansible/latest/intro_configuration.html#openssh- specific-settings)

</comment></comment><comment><USER11> It's a trap, Ender, this is not a tutorial!

</comment><comment><USER12> [https://pyinfra.readthedocs.io/](https://pyinfra.readthedocs.io/)

</comment><comment><USER13> I like how Ansible shows how sometimes technology can come full circle.

Ansible started as a more organized way to manage infrastructure beyond hacks and handmade scripts. As technology matured and infrastructure become more complex, the simplicity of Ansible fell short, and tools like Puppet and Chef came into scene.

But technology kept pushing forward, and these tools evolved to become increasingly complex until they become behemoths with towering ecosystems around them.

Enter containers and container orchestration. Suddenly many of the problems that configuration managers were trying to solve aren't there anymore. And suddenly Ansible simplicity, which became its weakness, has become its strength.

<comment><USER14> > As technology matured and infrastructure become more complex, the simplicity > of Ansible fell short, and tools like Puppet and Chef came into scene.

Wait what? I'm pretty sure Ansible came after Puppet and Chef, not the other way around.

<comment><USER15> CFEngine 1993 (for completeness)

Puppet 2005

Chef 2009

Salt 2011 (also for completeness)

Ansible 2012

OP's timeline is a bit off :)

<comment><USER16> Before CFEngine, people used the 'm4' macro processor to generate configuration files. It was very common for sendmail ones, but also for fast replication with minimal differences.</comment></comment></comment></comment>


Show HN: Procedural image generator in C - <AUTHOR> https://github.com/andportnoy/imggen <comment><USER2> Probably should abstract away the PRNG use, so you can retarget away from the C library _rand_.

<comment><AUTHOR> What's a good uniform alternative to _rand()_ in C?

</comment></comment><comment><AUTHOR> Would be grateful if people could point me to more resources on procedural image generation, preferably something genetic/evolution based.</comment>


One free expert website review, everyday - <AUTHOR> http://onereview.website/ <comment><USER2> On Firefox - The input fields have no label or placeholder. Unsure what I'm meant to put into these.</comment>


Ldd arbitrary code execution (2009) - <AUTHOR> http://www.catonmat.net/blog/ldd-arbitrary-code-execution/ <comment><USER2> I've always thought it a bad idea to make the dynamic loader its own executable, and allow binaries to specify their own. In this way dynamic linking on *nix seems like it was just a tacked-on afterthought, and not designed particularly well.

On Windows, you can find dependencies by just parsing import tables and following the chain as deep as you want to go. No need to execute any foreign code.

</comment><comment> vezzy-fnord This is from 2009. Hasn't ldd(1) been patched since then not to perform direct execution?

<comment><USER3> No, it's just how it works. You can use `lddtree` if you want the linking dependency tree without that.

</comment></comment><comment><AUTHOR> found this article after compiling some very simple golang program ([https://tour.golang.org/welcome/1](https://tour.golang.org/welcome/1)) and expecting small footprints. Not so. Why? Counter intuitive compared to C. The simple Hello world of 74b compiles to 1.7Mb.

This article gives a hint why: [http://harmful.cat-v.org/software/dynamic- linking](http://harmful.cat-v.org/software/dynamic-linking)

<comment><USER4> That cat-v article ignores some important reasons (not all of which still hold) for using dynamic linking. In fact it starts with a misunderstanding:

> All the purported benefits of dynamic linking (aka., 'shared libraries', > which is a misnomer as static linking also shares libraries) are myths while > it creates great (and often ignored) problems.

The "shared" in in "shared libraries" doesn't mean two programs use the same instruction sequences, it means that the code is mapped into physical memory once and multiple process share that page (perhaps mapping it into different part of their own virtual address space.

The sharing the cast-v author is talking about is de minimis. e.g. every compiled c program on your machine includes the same implementation of _start that sets things up and calls main() but we don't call that "shared". Likewise all the internal intrinsics (architecture-specific implementations of things like memmove()) -- they are all statically compiled into the binary.

Shared libraries were designed to solve several problems, some of which still exist: \- reduce the size of programs (less relevant since disks and RAM are big) \- reduce ram footprint / reduce paging (arguably less relevant but basically still really important) \- be able to update all programs with common features.

It's the last that is still crucial and which causes so many problems. When, say, there's a security problem in Webkit, an updated version of the webkit code can be installed, immediately (well, upon restart) providing that fix to all programs that used Webkit. Otherwise the end user / in house deployer would need to recompile every program that used Webkit (even if they could figure out what those were) and redeploy them all.

There are in fact plenty of special case reasons to use static linking, but most of the arguments against dynamic linking don't stand up to scrutiny. They are more expressions of legitimate frustration.

<comment><USER5> This is certainly very true, and the pessimistic tone of the cat-v article is, to some degree, unwarranted, but it's also worth pointing out the unanticipated problems real life brought.

In practice, _this_ is something that happens less often than we'd want:

> It's the last that is still crucial and which causes so many problems. When, > say, there's a security problem in Webkit, an updated version of the webkit > code can be installed, immediately (well, upon restart) providing that fix > to all programs that used Webkit. Otherwise the end user / in house deployer > would need to recompile every program that used Webkit (even if they could > figure out what those were) and redeploy them all.

In fact, many applications either rely on bugs and quirks in the libraries they use, end up forking and packaging them separately for entirely unrelated reasons and so on. OpenOffice, for instance, used to pack its own libc for a long time, and -- more recently -- Google's own policy for Chrome is to fork things madly. And sometimes there's just no choice (e.g. when relying on a bug/quirk in a closed-source library).

In all these cases, which are remarkably common, being shared doesn't help. This tends to be _especially_ true for big-ass vendor packages, which pack every single library they can. You're still dependent on their goodwill for updates, just as you'd be if they had statically linked their stuff. Your package manager will gladly update libfoo from 1.9 to 1.9.1, which solves a million security bugs and one, and that will help exactly not at all, because there are probably two or three programs on your computer that pack libfoo 0.9 on their own.

Ironically enough, this seems to be the direction in which (some of) the Linux desktop is moving, with containerized applications and so on.

</comment></comment></comment><comment><USER6> Better lesson - don't run stuff as root.

<comment><USER7> So true. And yet, count the number of `curl [http://pwn.you](http://pwn.you) | sudo bash` install commands out there, or the number of userspace programs which just don't run if they aren't run as root (docker), or which require passwordless sudo privs (salt-ssh). And then there's all of the recommendations across the web to just `setenforce 0` to get around configuring your app to work with selinux.

Root isn't going away anytime soon, sadly. It just makes developer's lives so easy they wouldn't know what to do without it.</comment></comment>


I Have No Idea [Why Apple Featured My App] - <AUTHOR> http://blog.mikeswanson.com/post/17160200980/i-have-no-idea

<comment><USER2> I don't know why everyone thinks that getting an app featured by Apple is some sort of huge conspiracy. If an app is of high quality and has some traction, it's not absurd for it to gain positive attention from Apple.

In the case of Halftone, the quality of the app is excellent and has significant usage. There are 1100+ reviews that average to 4.5 stars. These numbers would be considered fantastic by any developer's standards.

<comment><USER3> Apple often features apps of poor quality and it's not always clear why (e.g. games with 3 stars developed by big names or indie apps not working as they promise). So, yes, I understand why people are surprised.

<comment><USER2> You are considering the inverse of the matter. The post is about a high quality app being featured. My comment was intended to say that it shouldn't be surprising when a quality app is featured.

</comment></comment></comment><comment><USER4> At the iOS road show, Apple showed a video that I fervently wish that they would make available on their developer portal. It was one of the highlights of the day. It was inspiring. They showed video montages of some of the ADA winning apps, showing how they were so polished, so beautiful, such a great user experience. The one with the DJ app was phenomenal. You left with a smile on your face. This was the kickoff. For the rest of the day, you were overwhelmed and enthralled with the quality and depth of the technical content and expertise. They want to help you build the best Apps. And that was before you stepped into the onsite developer labs.

Apple wants you to build beautifully crafted user experiences. Google does too, but that is not their primary focus.

</comment><comment><USER5> Tangential anecdote - I worked with Mike at Microsoft where he did some stellar work putting together all the conferences Microsoft did over the years. He was one of the few who 'got' it. Fantastic to see him get some well- deserved recognition - and that too, outside the MSFT family!

</comment><comment><USER6> Another approach to vector art in iOS using PDF files [http://mattgemmell.com/2012/02/10/using-pdf-images-in-ios- ap...](http://mattgemmell.com/2012/02/10/using-pdf-images-in-ios-apps/)

</comment><comment><USER7> Wow, I actually had no idea you could convert paths from illustrator to Objective-C code! This just opened a whole new world for me. Thank you!

Side note: digging a little bit, here's a very useful library for converting SVG to UIBezierPaths: [http://ponderwell.net/2011/05/converting-svg-paths-to- object...](http://ponderwell.net/2011/05/converting-svg-paths-to-objective-c- paths/)

</comment><comment><USER8> Buried lede department : "I decided to build a new plug-in that exports Illustrator artwork directly to Objective-C code". There's a new product. While the Opacity app is good, it's a bit neglected. A plug-in for Illustrator would make me and my designer thrilled!

</comment><comment><USER9> It's good he has no idea. It proves that there's no special treatment, that the App Store staff use these app themselves out of review time. The alternative is some sort of time/money/review requirement which isn't as purely effort-rewarding as this way.

<comment><USER10> One data point doesn't at all prove there's no special treatment, but it is good to hear about one case where special treatment didn't appear to be involved!

</comment></comment><comment><USER11> As a side note. I find it puzzling why Apple haven't included some sort of vector support natively.

Seems like such a powerful thing to be able to use more freely.

Anyone knows why that is? CPU, battery something else? (I am not a programmer)

<comment><USER12> PDF is the OS X and iOS native vector format (and before that, PostScript). It was one of the great design decisions made by the early NeXT OS engineers, even though few people understand what "Display PostScript" or "Display PDF" really means.

Most of the toolbar icons you see in Mail, Preview, Finder, etc. are actually PDFs that scale to any size.

The OP could have (and probably should have) used PDF for his vector-based graphics. And actually, by exporting raw CoreGraphics drawing functions from Illustrator he's essentially exporting a PDF document in a custom file format.

</comment></comment><comment><USER13> Great stuff. I love when people sweat the details.

</comment><comment><USER14> Are we sure the rewind list isn't decided by one staff member at Apple, who ticks a few boxes one morning at their cubicle?

Somehow I knew the app wasn't going to be free after reading the article: "I just have no idea, except maybe that's it a really quality app [that you too can feature on you homescreen for just 99 cents]".

<comment><USER15> That seems overly cynical. He designed a method of vectorising images in order to ensure quality of resized stamps - I don't think you should be complaining that he's charging for such work.

What I don't understand is why Apple wouldn't indicate why an app is featured - if for example high quality and innovation are prized then this should be lauded aloud to encourage others.

<comment><USER14> So I bought the app and checked it out. I may be cynical, but I also buy apps, (and my right to be cynical).

I made an image with the app just now: <http://i44.tinypic.com/aua3ic.jpg>

Review: 3 stars Good UX path on loading the app, guides you through steps. The designer of this app has done well to make a sensible interface, with only some work needed on the settings screen and the labeling choices there.

Replay value is another question. There's no sequencing layout tools or anything relating to more than the single image you're working on. Tools are not that powerful, but they do their job ok. It does one trick, and most people will probably use it one time.

Yep, the vector thing is pretty cool.

Now it just needs the ability to arrange and re-arrange multiple images, and swipe through them as a slideshow. Throw in a library of sound effects to assign each slide, with animated visual effects for little movie-making mobile graphic novels... and THEN it'd be a paid app worthy of promotion in my mind, but this is a good start.</comment></comment></comment>


Startup world's little secret: Everyone's using TaskUs but no one is talking - <AUTHOR> http://pandodaily.com/2013/07/17/the-startup-worlds-little-secret-everyones-using-taskus-but-no-one-is-talking-about-it/ <comment><USER2> It must be nice to get Pando to give your company a big sloppy wet French kiss like this. If you're the company, that is. If you're Pando it's just embarrassing. (But then you're Pando, you're probably used to embarrassment by now.)

 _> Maddock claims his employees get paid "above average" salaries in the Philippines for business process outsourcing (known as BPO in the Philippines) work, but he didn't want to reveal exact numbers. He's concerned TaskUs employees might get disgruntled to see where their salary fits in the pecking order._

This is a weirdly written paragraph. I can't tell if he means that TaskUs doesn't want to reveal salary figures because he's afraid his employees would be mad if they found out what they were paid _relative to each other_ , or _relative to other workers in BPO in the Philippines._ But either way, it's not encouraging -- if he was paying fair wages, you'd expect him to be trumpeting that fact, not hiding it. So he probably isn't...

 _> Without the numbers there's no way to fact-check how these outsourced employees' paychecks compare to cost of living. But the success of TaskUs seems to require that its employees are happy and fulfilled enough to do good work._

...Oh! So it turns out the numbers don't matter after all -- we can just _assume from the fact the company exists_ that it pays its employees well.

I guess that's Journalism 2.0™.

</comment><comment><USER3> This is a clever PR move by TaskUs. Rather than emailing Pando and saying "Look how popular we are", like everyone does, they said "Look how few of our many happy customers want to talk publicly about us."

Anytime you can give them something more interesting than a story about users or funding, it's more likely to be covered and more likely to resonate with readers, [edit: I think].

</comment><comment><USER4> No surprise here. I have two part-time Filipino VAs who are very competent and a pleasure to work with via oDesk. I'm not sure why companies are hiding this - it's a competitive advantage. Also, to take it further, I'm not sure why more tech startups aren't utilizing the large number of very skilled Eastern European developers to complement their home team. The world is flat.

<comment><USER5> A lot of startups don't use offshore workers because it's a logistical nightmare. My company (not a startup) has our QA office based out of Bangalore. As an engineer who delivers things to be verified by said team this is a real pain in the ass. Sunday through thursday my evenings are basically fucked. Every night at 9pm from Sunday to Thursday we have a synch-up call so I never get the chance to make any plans during the week.

Over the years this gets really bothersome. It's usually the number one reason why people I've known at my job have found employment elsewhere. Every time I think about changing jobs, I think about the reasons why I would like to, and this is almost always the number one reason.

<comment><USER4> I obviously can't speak for your company and it's unique situation, but I'm sure there's ways to mitigate and better manage this process.

<comment><USER5> From an engineering standpoint you are correct. From a business standpoint none of these problems have quantifiable numbers attached to them (my lost enthusiasm per fort night?) so they basically don't exist. Ascertaining my opinion on how I believe management is running things will be left as an exercise to the reader :)

</comment></comment></comment></comment><comment><USER6> _Outsourcing, of course, always saves money,_

Um, no it doesn't. Sometimes it does, sometimes it doesn't. Your mileage may vary. It was this thinking that led to all sorts of idiotic outsourcing deals in the early 2000s where businesses discovered there are many scenarios where outsourcing _increases_ costs.

We've gotten a lot smarter since then but statements like this make me bristle.

</comment><comment><USER7> This is one of the fluffiest articles I've seen on here in a while.

</comment><comment><USER8> This is tangential to the point, but TaskUs has _the best_ website of any "outsourcing" company I've ever encountered. Understanding (pardon) what in the _fuck_ an outsourcing company actually does is often absurdly difficult. I don't know why it's so hard to be direct about what you do on a company website.

While the article might appear to be an obvious PR play, it really does underscore that TaskUs is taking a different messaging tack from their competitors. How many outsourcing companies eschew language like "leveraging strategic opportunities for enhanced efficiencies", and in place, cite specific examples of jobs that are being done? It's refreshing.

</comment><comment><USER9> > _We thought about raising funding [from family and friends] to get press. > Then once the stories were done, we would just give it all back because we > don't need it._

People (and the press) need to stop printing nonsense like this. You don't need money? Then don't take it. Any other path screams: We needed money and we're gonna insult your intelligence with a press statement.

To his specific point: The cost of funding would buy a whole lotta press. So cut the crap.

</comment><comment><USER10> If nothing else, this story is a fantastic example of great startup PR.

</comment><comment><USER11> I'm not sure if I'm missing something, but it sounds like a small outsourcing company like any other outsourcing company?

</comment><comment><USER12> Counting the seconds until a scathing, sarcastic piece on this is written on Valleywag.

</comment><comment><USER13> Apparently payola is alive & well at pandodaily.com.

</comment><comment><USER14> Useless article is useless.</comment>


Wrong Answer - <AUTHOR> http://www.newyorker.com/magazine/2014/07/21/wrong-answer

<comment><AUTHOR> Have a quote:

"But Lewis began to worry that mathematics had assumed an unhealthy role in the district. "Data" and "accountability" had become almost magic words: if administrators repeated them enough, it seemed they believed that scores should rise, even if there hadn't been significant enhancements in instruction. Lewis welcomed the district's new emphasis on reading—teachers got specialized training and taught reading more intensively—but many of the other reforms were oriented around deadlines and time frames. Lewis said, "We had two weeks to teach percentages, and if you're still on percentages at week three, because your kids don't get it yet, they'll say, 'You don't teach well enough!' Well, come, now, we are dealing with human brains." He continued, "I sincerely believe that demographics does not determine destiny. But you have to be patient.""</comment>


Meet "raw" water – ludicrously priced unfiltered water with random bacteria - <AUTHOR> https://arstechnica.com/science/2018/01/fear-tap-water-is-a-toxic-plot-to-control-your-mind-heres-the-water-for-you/ <comment><USER2> This is the dude that started that Juicero nonsense. Now he's circumventing all of the progress we've made in the last few hundred years with making water potable. This should end well.

<comment><USER3> Someone take away this guy's license to conduct business, please. Snake oil is played out.

<comment><USER4> Unlikely, when after decades, homoeopathic "remedies" are still regularly sold at Whole Foods [1]. The FDA seems to take the stance that if it's not obviously toxic, conmen can sell anything they can get enough people to believe in.

[1] If you don't already know why homeopathic remedies are complete BS, look up "homeopathic dilution" and the meaning of the markings such as "30X" or "10C" found on these products.

<comment><USER5> > The FDA seems to take the stance that if it's not obviously toxic, conmen > can sell anything they can get enough people to believe in.

The agency does not wish to take this position but was required to by an act of congress sponsored by that notable scientist and physician Orrin Hatch. You ask what his medical qualifications are? Campaign $$$ of course ([http://www.nytimes.com/2011/06/21/us/politics/21hatch.html](http://www.nytimes.com/2011/06/21/us/politics/21hatch.html) )

Despite this the agency has still managed to come down hard on unsubstantiated medical claims by some homeopathic rip off artists. But basically $25 Bn can fund a lot of laws to hurt the public.

</comment></comment></comment></comment><comment><USER6> Some of us grew up on well water. It's generally fine, although you need to inspect and treat it regularly, and if one of your neighbors really messes up his well, it can affect the whole water table around him too. My digestive track always gets a little messed up when I visit my parents back home (although this could also be from the water being treated for hardness).

If you were really interested in non-municipal water, the best route to go would be some sort of filtered reverse osmosis setup or something similar, of which you most certainly do not need a Silicon Valley snake oil salesman for. You can also get a home system to make distilled water just for drinking that won't cost that much.

Honestly, the biggest issue that the average person could have with municipal water is it being overly hard. I might get a filtration system in our new place to deal with that. I might also be tempted to get some kind of filtration system for water just for my coffee and tea, simply for taste reasons.

<comment><USER7> >Some of us grew up on well water. It's generally fine, although you need to inspect and treat it regularly

You need to _inspect_ it (the CDC recommends annually sending away for a water test[1]), but I'm aware of no EPA or CDC recommendation that calls for unconditionally _treating_ the water. You treat well water only if the tests find a problem.

[1] [http://www.cdc.gov/healthywater/drinking/private/wells/testi...](http://www.cdc.gov/healthywater/drinking/private/wells/testing.html)

[https://www.cdc.gov/healthywater/drinking/private/wells/trea...](https://www.cdc.gov/healthywater/drinking/private/wells/treatment.html)

<comment><USER6> This is true. It's just that you usually find some issues every few years that you at least need to throw some chlorine in the well.

<comment><USER8> We never did anything to the water wells at places we lived in for 10+ years. Were we just lucky?

</comment></comment></comment></comment><comment><USER9> If you are interested in 'raw' water live somewhere on a well rather than on mains water and do your own filtration...buying water in containers isn't cost effective, unless you are Nestle selling it...

[http://www.desertsun.com/story/news/environment/2017/12/21/c...](http://www.desertsun.com/story/news/environment/2017/12/21/california- regulators-tell-bottled-water-maker-nestle-halt-unauthorized-water-diversions- national-fo/928071001/)

</comment><comment><USER10> From the makers of Juicero comes Cholera water!

This aligns pretty well with the ideas of the anti-vaccine movement though.

<comment><USER11> >This aligns pretty well with the ideas of the anti-vaccine movement though. //

Can you expand on that at all, what particular ideas do they have that this aligns with. Seems a long way from "vaccines contain stuff that is deleterious to health" [which is sometimes true, though key is that provably carriers in infant vaccines weren't causing Autism] to "we should drink water with unknown pathogens in".

Surely the refusal to put unknown pathogens in your body would align better with the refusal to put unknown vaccine constituents in to your/your child's body?

<comment><USER10> In the article they talk about how this water appeals to those who are worried about prescription drug residues and fluoride in their drinking water.

It seems like the anti-vacc movement makes poor health decisions based on a flawed or limited understanding of science and a strong faith in pseudo- science.

Science says vaccines are good, pseudo-science says that scientists are wrong and vaccines cause autism. Science says fluoridated water is okay, the jury is on on prescription residue, and we have a pretty clear idea of what happens with contaminated water consumption, pseudo-science "look what sort of nasty things science put in your water! Lets go with natural water from dirty sources!"

Edit: It's not about keeping unknown things out of their body, it's about a small group of non-scientists making unfounded allegations that can undermine the efforts society has made to improve the health of humanity (small pox, cholera, etc.)

<comment><USER11> >Science says fluoridated water is okay //

Hmm, Wikipedia tells me the studies have been low quality as to whether it's harmful in any way. EC don't recommend using fluoridation of drinking water as they see no benefit when topical application is available ...

With such an important aspect of public health it strikes me as curious in the extreme that there aren't many high-quality studies?? That alone gets me concerned that something is being hidden ... is it any surprise that this would be a widespread concern?

>a small group of non-scientists making unfounded allegations //

The Autism-Vaccination issue was initially scientists raising a concern; in what appeared to be reasonable research. Until the USAmerican removal of mercury containing compounds from the vaccine and the subsequent lack of effect on autism levels I'd say it was still an open question [happy to be corrected on that, I've only looked back on the issue]. It turned out to be an [apparent] correlation without a causative link, but we had to wait a couple of years for that to come back - then there was large scale data.

</comment></comment></comment></comment><comment><USER12> I'm guessing a HN commenter posted this comment on the article's page:

> Let's call it Live Blockchain Water and watch the cash roll in!

I nearly spit my drink out.

</comment><comment><USER13> Don't know about about other countries but where I live obtaining and selling spring and mineral water is nothing unusual. There are laws that regulate it to ensure it's safe for consumption.(link with english translation on the right side) [https://likumi.lv/ta/id/278817-noteikumi-par-dabigo- mineralu...](https://likumi.lv/ta/id/278817-noteikumi-par-dabigo-mineraludeni- un-avota-udeni)

Pay attention to point 16:

> 16\. Any disinfection treatment by whatever means and the addition of > bacteriostatic elements or any other treatment likely to change the viable > colony count of the natural mineral water is prohibited for natural mineral > water and spring water.

<comment><USER14> In my country (Brazil) buying bottled mineral water is also common. But I don't know whether it comes directly from the spring, or is passed through a filter first. We learn from childhood that one must only drink filtered or boiled water, so I won't be surprised if there's a filter involved.

<comment><USER13> Tap water is fine in most cities here but many people just prefer the taste. Not many buy it for drinking at home but it is very common in water coolers at offices.

</comment></comment></comment><comment><USER15> Matt Levine had a pretty funny take on this: [https://www.bloomberg.com/view/articles/2018-01-02/citi- told...](https://www.bloomberg.com/view/articles/2018-01-02/citi-told-some- customers-to-buy-the-sells)

But really, can this even be sold? What does the FDA do, exactly?

<comment><USER16> Are there laws against selling untreated well water? I mean, you're allowed to drink out of your well, shouldn't you be able to sell it if you state its origins and testing results truthfully?

<comment><USER15> Well, yes, you should be able to if all the tests are done. But, If I report 6/10 tests, then what?

</comment></comment></comment><comment><USER17> Hey great, now the high and mighty of SV can barf all over one another at their orgies.

</comment><comment><USER18> The thing is that there will be people wanting to defend this product. It will become just another thing like 'natural salt' that has no added iodine but has lots of impurities in it. This is then packaged as 'non GMO' and 'Gluten Free' amongst other organic things.

As a regular user of a bread making machine I do wonder if my bread would be improved by the use of this posh salt rather than the table salt I normally use. Would I live longer by not having the anti-caking ingredient added to the teaspoon of salt I use with my bread?

So, after a push of a button and a couple of minutes exactly measuring flour, water, salt, sugar, butter and yeast I get perfect fresh bread. Meanwhile, the mystery individual 'ms Ancedote' goes the whole hog on using overly-good ingredients to make some 'even better bread'. This will be using wholemeal organic spelt flour instead of regular strong wholemeal flour, this will also be measured in 'cups', not weighed. So all the other ingredients are fancy, e.g. the salt, the oven will need to be on for hours and lots of noises and mess will be made. Net result is essentially unrisen bread, the science not understood, the interior still sticky dough, the outer with a thicker and dryer crust than one might want. To my science mind this is madness, a lot of work with ingredients coming from all four corners of the globe, just for some bread that is wrong. All kinds of exciting herbs and what-not could also be added, such 'rustic' fun is the desired thing, it does not taste like store bought bread and that is what matters. The fact it takes five hours to make is part of it. None of it makes sense until you learn the word 'orthorexia':

[https://en.wikipedia.org/wiki/Orthorexia_nervosa](https://en.wikipedia.org/wiki/Orthorexia_nervosa)

So my mystery friend that makes awful bread and does not want to be making normal bread like I do, why is this? It is just one symptom of a bigger thing going on, orthorexia.

I would say there is a whole industry going on around orthorexia and that these guys are tapping into that market.

</comment><comment><USER19> This seems pretty funny at a glance, but on the other hand there's a really really big elephant in the room today - and that is the state of the American population. Our overall healthfulness has decreased dramatically in just a few decades. The US life expectancy is even in decline. This all correlates with things like the rise of the internet, but the rise of the internet has occurred worldwide whereas the degree of unhealthfulness of the US is something unique in its degree - and that's in a large population. It's easy to blame things look unhealthy food, yet I don't think we have 70% of the population downing Big Macs while treating soda like water in a desert oasis. In either case gluttony is hardly an American exclusive.

I'm not suggesting that it's the water, but I am suggesting that it is not unreasonable to think that something we probably believe is perfectly reasonable or even healthful may be having unforeseen consequences that have yet to be precisely singled out. And so experiments that sound stupid may not be such an awful idea. Penicillin was only accepted long after its discovery. A big part of the reason for that is using a byproduct of blue-green mold to treat vulnerable bacterial infections is something most people intuitively dismissed as idiotic - even after the discoverer presented and published his findings. If there's a market for folks that want to down 'natural' water at a premium, then I think this is a good thing. They get to act as guinea pigs for the whole of society, the guy makes a few bucks, and in the end everybody learns a bit more.

<comment><USER20> I take your point, but, we have a long case history of what happens when we don't have clean water, starting here: [https://en.wikipedia.org/wiki/1854_Broad_Street_cholera_outb...](https://en.wikipedia.org/wiki/1854_Broad_Street_cholera_outbreak) (well it started before that, but this is when epidemiology became a thing.)

safe water doesn't need to be sterile. In the UK, you are allowed a certain level of "harmless" bacteria. However there are strong laws that are _enforced_ to make sure that people don't get harmed.

Now, there _might_ be a case that "raw" water provides/boosts/promotes certain gut flora in people that is beneficial. However gut flora is a new and little understood science. Applying occam's razor to declining health in the US, and I'd point to two things:

1) increasingly sedentary lifestyle

2) Terrible health system that denies basic care for >60 million people and pumps the rest full of narcotics.

Unlike the gut flora theory, there is a mountain of evidence to back it up, not some bearded weirdo with little connection to the real world.

<comment><USER19> The problem with things like sedentary lifestyles is similar to the problem with internet correlations, which in either case imply the same thing. Compare the US to other nations experiencing similar problems and it's reasonably clear that whatever our issue is, it's unlikely because of lifestyle changes alone. Other similarly well developed nations with lackadaisical lifestyles don't suffer the same problems, yet impoverished nations such as those in the Pacific isles do. And in many cases, the problems are confined by our invisible borders. The Czech Republic is a good example there. Bordered by Poland, Germany, Austria, and Slovakia. Czechia is rapidly approaching problem levels, its neighbors are not.

There's a great distance between cholera and less filtered water. Worldwide the high end estimate of cholera deaths is 130,000 and that is with liberal modeling of unreported deaths. A quick search informs [1] that about 2 billion people a year rely on water that is absolutely contaminated with feces. That's a 0.0065% death rate at the high end. Usage of isolated or private water sources along with basic testing can trivially reduce these risks down to 0. And on that note of giving context to numbers, we should look at things like the opioid epidemic. In the US in 2015 about 15,000 people died from all opioids. Even if we assume that it was 0 before, which it was not, that would not explain the ongoing decline in life expectancy. The real reason is mortality rates from a wide array of diseases including 8 of the top 10 killers, heart disease in particular, continue to rapidly grow alongside our unhealthfulness. And that was after they had been in decline for decades.

[1] - [https://www.compassion.com/poverty/water.htm](https://www.compassion.com/poverty/water.htm)

</comment></comment></comment><comment><USER20> I love dysentery.

All it takes is someone/thing defecating in the well and you'll get cholera.

Epidemiology literally came about because of "raw water" [https://en.wikipedia.org/wiki/1854_Broad_Street_cholera_outb...](https://en.wikipedia.org/wiki/1854_Broad_Street_cholera_outbreak)

</comment><comment><USER21> I suppose this is meant as a counter-piece to the article that recently was on the HN front page:

[https://www.nytimes.com/2017/12/29/dining/raw-water- unfilter...](https://www.nytimes.com/2017/12/29/dining/raw-water- unfiltered.html)

<comment><USER22> I think the NYT article is already critical of the movement without becoming snarky likes the Ars article:

> _(There is no scientific evidence that fluoride is a mind-control drug, but > plenty to show that it aids dental health.)_

> _Talk like Mr. Singh's disturbs Dr. Donald Hensrud, the director of the > Healthy Living Program at the Mayo Clinic in Rochester, Minn. What the raw- > water partisans see as dangers, he says, are important safety measures._

> _"Without water treatment, there's acute and then chronic risks," Dr. > Hensrud said, including E. coli bacteria, viruses, parasites and > carcinogenic compounds that can be present in untreated water. "There's > evidence all over the world of this, and the reason we don't have those > conditions is because of our very efficient water treatment."_

Admittetly it wouldve been nice if more counter-voices would've been heard even though the purpose of the reader is to acquaint the reader with the movement (assuming - I guess - a certain reasonableness of the reader)

</comment></comment><comment><USER23> FWIW, I absolutely love my in-law's unfiltered well water. It's ridiculously hard water (tons of calcium etc.), and tastes very sweet as a consequence. I haven't ever had water that tastes as good, and we always fill up a couple jugs to take back with us.

If I were somehow lose access to that water I'd probably try this at least once just to see if it's close.

<comment><USER8> I've had well water with a lot of sulfur in it a few times. Not sure if I'd say I like it but it's an interesting experience.

<comment><USER23> Yeah, the sulfur heavy ones are pretty terrible, but that's not all Wells.

<comment><USER11> People will buy sulphurous water, "tastes vile enough that it seems like it could be a medicine" I think is the rationale. Eg at Bath in the UK, not sure if you can take it away but you can buy a glass in the tea-rooms.

</comment></comment></comment></comment><comment><USER24> This is ludicrous but these guys still manage to change people's purchasing behavior. At work I see a lot of people drinking $2 "Honest Tea" which is just tea with a lot of sugar. On the face of it this is ridiculous but people buy that stuff. In the age of $2 tea and $4+ coffee I can see a big market for overpriced water.

</comment><comment><USER25> The best water I have ever tasted comes from a spring in the Red River Gorge area of Kentucky. If anyone is rock climbing in the RRG and wants to give it a try look for pipe sticking out of a hill side about a half mile before the Nada tunnel when entering the gorge.

Edit: Just looked up the exact location, 37.815495, -83.692356

</comment><comment><USER26> This reminds me of a quote of General Ripper from Dr Strangelove: "Mandrake, do you realize that in addition to fluoridating water, why, there are studies underway to fluoridate salt, flour, fruit juices, soup, sugar, milk... ice cream. Ice cream, Mandrake, children's ice cream."

</comment><comment><USER27>
      > raw_water == snake_oil

      True

</comment><comment><USER28> This "toilet water" part really reminds me of the movie Idiocracy...

</comment><comment><USER29> Are you supposed to boil it?

</comment><comment><USER30> I guess this is good news for Wendy Northcutt.

</comment><comment><USER31> It's easy to dismiss the claim that fluoride is a mind control drug, if taken literally.

When I've probed just a little the actual claim I've heard is that it somehow affects personality, making for easier to control masses.

I don't know whether that's true but at least that's a claim that can be falsified.

The other thing is:

"Tap water? You're drinking toilet water with birth control drugs in them,"

There's plenty of evidence for _trace_ amount of estrogen and estrogen-like substances in the water. Maybe that's not an issue, but it's also true that testosterone levels in men are declining worldwide. However there can be a number of causes for this, and the two are not necessarily linked.

Not mentioned in this article, but on HN frontpage earlier, there's tons of micro particles of plastic in oceans, and subsequently wild fish.

I don't know those subjects enough to make any kind of informed observation… But dismissing all of it as conspiracy theory doesn't really sound convincing anymore.

<comment><USER20> fluoride isn't a mind control drug. They are too hard and don't work. From memory Cyclizine which is a motion sickness drug was originally a "truth serum", so you know, scandal and all that.

Social conditioning works far better, with facebook and twitter its fairly easy to do at scale (see bubble bias)

Tap water (in the uk at least) must be filtered _and_ sterilized, which should remove microplastics.

However, some places just take river water, a rough filter and a massive UV light. (I've been to many a camp site that has this, heavy rains make the water taste different.)

<comment><USER11> >Social conditioning works far better //

 _Por que no los dos_?</comment></comment></comment>


The Boolean Graph - <AUTHOR> http://kevinrose.com/the-boolean-graph

<comment><USER2> I find it hard to sympathize with most things Kevin Rose writes. Pardon my french but this sounds almost a little... childish? irrelevant?

He thinks it's socially awkward to unfriend some of his several thousand friends? Why did he friend them in the first place? How can he say with a straight face (I'm assuming) that apps like Path and Instagram have shown him that rebuilding his social graph every few years is a "must"? Because of fights with friends? Do adults really fight with their friends and then unfriend them on Facebook? How about just hugging it out afterwards?

These are contributions I'd expect from a mainstream celebrity, but I don't feel like this represents the hacker culture (call it whatever you want) very well.

Sorry for the off-topic. I do like the dynamic, perhaps even implicit, graph idea though.

<comment><USER3> Honestly, I thought that was the whole point of circles in Google Plus. You make a "Siberia" circle, and the friends you don't want to have anything to do with, you put in that circle, and you crank down the visibility on their posts and don't share stuff with them. The effect is the same, but without them finding out that you unfriended them.

<comment><USER2> True. At campfire labs we were working on similar asymmetric friendship groups before we got acquired. The problem is that you still have to manage those circles though. In real life, you don't have to put in work to manage your friends. You just know how they fit into the ever-changing friendscape.

<comment><USER3> Yes, but in real life we don't have ways of broadcasting to this ever-changing landscape. In fact, we tolerate quite a bit of collateral damage: you tell your brother something in confidence and he goes and tells your mother.

Socially, yes, this is insufficient. But this isn't really about social reality, it's a technical solution to boredom, which means people enjoy putting work in to manage their friends. It's the whole reason they're there.

</comment></comment></comment></comment><comment><USER4> The relationships on Facebook appear boolean, but they are hardly treated as such by Facebook. They have many ways of determining how "close" I am with any one of my friends by looking at the number of times I interact with them, view their pictures, etc. They also let you explicitly mark how much of each friend you want to see in your news feed. Then it is only a matter of weighting their updates accordingly. So I would argue that Facebook knows about this and does the right thing (or at least tries to).

<comment><USER5> > They also let you explicitly mark how much of each friend you want to see in > your news feed.

Part of the problem is the lack of a reverse of this function. That is there is no(easy) way to turn down what you share with them. This is the problem G+ circles tries to solve.

<comment><USER6> FB has a notion of close friends and you can set your default publishing setting to be that. This isn't exposed anywhere, like some close friend list

</comment></comment></comment><comment><USER7> I thought Facebook was mostly just for those people who you don't interact with a bunch. People who are my friends who I see often... well, I see them. I don't need to poke them on Facebook. Where I find FB interesting/somewhat useful is in that set of people who I otherwise would not be able to track much.

Somewhat distant relatives, friends who no longer live close by, even one of my elementary school teachers... that kind of thing.

<comment><USER8> _I thought Facebook was mostly just for those people who you don't interact with a bunch._

David, the use cases of Facebook vary quite a bit. I have had a lot of fun over the last few years talking in person with friends at regular meet-ups about things we each saw on Facebook pertaining to other friends of ours. I think whenever there is a group of friends who have local meet-ups frequently, but also connections with people in far-away places (which might happen for the mutual friends who are all members of some national organization, the case I have observed), then there is a chance for Facebook to ENHANCE in-person interaction with people you see regularly. As I recall, you are an American currently living overseas (a situation I have been in twice in my life), and it may be that for you the local versus distant distinction among people in your circle of friends is more salient. I think one of the geniuses of Facebook's "friend" model is that everyone constructs a different network of Facebook friends, and enjoys it in a different manner. I STILL can't figure out how Facebook will monetize, but I've been pleasantly surprised by how much Facebook has added to rather than subtracted from my in-person social relationships.

</comment></comment><comment><USER9> For the most part social networks give you the tools to manage friends fairly well. I know on Facebook you can change a setting to only view important updates from people. I like this option because you don't have the social awkwardness of unfriending someone. But, you don't have to constantly see what they at for lunch.

Also, I think we just get bored with things. That's human nature. We like new things. We want to be part of cool new trends and technology. So once something hits mainstream and stops being cool, we start looking elsewhere for the next cool service to try.

<comment><USER10> Having to manage an externalized representation of your relationships is what is against human nature. Feeling social pressure to check daily, weekly, or even monthly on the activities of every person you may have ever met is what is against human nature.

</comment></comment><comment><USER11> +1 for "*Full disclosure: I own a metric shit ton of Facebook stock, so it pains me to write this."

</comment><comment><USER12> I have the opposite experience. I have no incentive to use new networks -- all my friends are on Facebook. Facebook is actually very good at (at least in my experience) showing me information from friends that I'm actively being friendly with. People from some event a few years ago fade out, while people I'm going to school with now are in full-swing. When I change my involvements during the summer, Facebook in turn fades them out and favors the other people I'm currently working with.

For me, Facebook does exactly what Kevin Rose desires.

I think his problem is that he, as he put it, friends people "in passing [he] hardly knows".

</comment><comment><USER13> I can definitely see his point about new social networks - probably the biggest win Google+ has given me was the ability to start my social network fresh, with only interesting people (also, mainly nerds, so I now post geeky stuff to Google+ and stuff my family/non-technical friends would care about to Facebook).

<comment><USER13> That said, this is also a problem of his own creation - I keep a fairly lean Facebook friends list (which I'll purge of local contacts I'm not close to after I move next week), and fairly often unfriend people who I'm not close to and consistently post things that don't interest me.

</comment></comment><comment><USER14> I think there's a big difference between how [my generation and] I (19 y.o.) use Facebook, and how older generations do.

For me, it is 80% keeping up with my current friends and 20% older friends. I think these ratios are perhaps flipped after a certain point, perhaps the people for whom their FB graph wasn't created organically from the age of 14/15 but rather, had to go and create it posthumously.

Yes, there are people I'm friends with who I'm not friends with anymore. But, if you use Groups + Lists (which all my non-techy friends use too), this isn't really an issue.

Anyway, I just see a lot of commentary on things FB is doing wrong by people > 25/30 y.o. But, for people below that age bracket (who tend not to be commenting in the media) it has (from my observations) replaced texting/phone/skype/letters/etc.

</comment><comment><USER15> _> No one has yet created a dynamic social graph. Facebook and other social graphs represent a rolling set of relationships that are out of date the instant they are created._

One thing that could be tried, that hasn't yet been done, is for a company to try and own the "dynamic edges" of the social graph. The active borders of the social graph embody a lot of value. If a bit of software could become the killer app for networking and meeting people, it would enable another party to own those "dynamic edges". Meetup.com is well positioned to attempt this. So is Facebook. Apple and Google are as well through their mobile operating systems.

</comment><comment><AUTHOR> I'm surprised Kevin has forgotten about Google+ and Circles (considering he works there).

Everyme (excuse the shameless plug) would also work very well for him. Both of these products seem like a good solution for his problem.

<comment><USER16> Facebook has circles but much better anyway. People just don't like to manage their graph.

</comment></comment><comment><USER17> If you make me grade my relationships with people (friend/defriend/link/put in circle etc.) you are making me work. You must reward me for that. On all these social networks my reward for that exercise is actually some negative feelings, netted against the positives of getting my message out properly. Maybe that's one reason Twitter is so popular among some, you don't really need to drop followers, you just tweet.

</comment><comment><USER18> Which gave me the idea: what would the response be if facebook culled your friends if you haven't interacted with them (by commenting or liking their posts, or messaging them)? They wouldn't need to announce the change. You just wouldn't see those people anymore. As is, I have friends whom I never see in my feed.

<comment><USER19> IIRC that's already something Facebook does with regard to the feed (as you mentioned). Say you get a friend request from someone you went to HS with, but outside of accepting the request you never interact with them on FB. They could post every day but you'd likely never see it.

I would imagine that the strength of the intersection of their graph with yours would play a role in this as well. Can anyone who works at FB comment on this? I'd imagine this is one of the back-end engineering problems the developers there would enjoy working on.

</comment></comment><comment><USER20> I don't use these services, so I'm probably wrong, but don't lists and circles solve this problem? While "friending" may be binary, you can adjust the connection to the other person/profile by moving them from e.g. "close friends" to "acquaintances" and therefore give them less or more access to your profile.

<comment><USER21> I think the issue Kevin has isn't their access to his profile, but his exposure to their content. When you're in high school you care about what your high school friends have to say, but 5 years later you don't care about what most of them have to say any more, but manually removing them is inconvenient and not caring what they say is not directly tied to being "friends" or not.

I think the solution he's looking for is something that analyses your interactions with a specific friend and the common interests and hides / reduces exposure to their content over time. Although I was under the impression Facebook already did something similar to this.

</comment></comment><comment><USER22> If you find this observation interesting you will definitely enjoy Maciej's analysis, "The Social Graph Is Neither":

<http://blog.pinboard.in/2011/11/the_social_graph_is_neither/>

</comment><comment><USER23> I wonder if some part of the answer isn't trimming friends, but instead trying to reconnect you with the people you shared moments with at some point in your life. Perhaps this is just fleeting nostalgia speaking.

</comment><comment><USER24> Answer: Twitter & asymmetric friending/following model.</comment>


Backblaze online backup almost acquired - <AUTHOR> http://blog.backblaze.com/2010/08/27/backblaze-online-backup-almost-acquired-breaking-down-the-breakup/ <comment><USER2> Odd as this will sound to the inexperienced, this story is not an outlier. This is what happens in the median acquisition. Investors now treat startups much better than they used to, but acquirers are the final frontier of assholedom. When you get interest from an acquirer, assume by default that it will play out exactly as described in this post: initial eagerness, followed by long and distracting delays, followed by an attempt to renegotiate the terms at the last moment. Then you can be pleasantly surprised if things turn out otherwise.

<comment><USER3> How should acquirers behave?

I've thought for a while that one thing that could change the dynamic is price. It doesn't make too much sense to me that a 5 month old company with $50K in it should go for more than $1M. That is the other side to the assholedom - the exuberant prices paid for young companies.

The price can and should change as the product and team grow, so this is mainly a comment about very young companies.

<comment><USER4> Why should inputs ("5 months old, $50K in") cap valuation when something unique has been created?

That'd be like setting prices by costs rather than value!

<comment><USER5> Because the buyer could build the technology themselves for $50K in 5 months. (Okay, $100K in 10 months, given the efficiency of large corporations.)

<comment><USER6> Assuming the buyer has the programming talent and vision to create it, and the managers to allow something "crazy" to be built. That's rare in large corporations.

<comment><USER4> And assuming that a 5-month delay wouldn't cost 10s-of-millions.

<comment><USER7> And assuming the startup in question has not acquired a few key patents. And assuming the startup made no unique-but-necessary technical decisions that can't be replicated without relying on information obtained under NDA.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Every experienced entrepreneur has this happen to them at least once in their lives, usually many times. You think you are so close to being acquired, only for it to fall apart. A startup CEO tends to spend all his/her time either raising money, or talking to a firm about being acquired.

The lesson would be not to sign exclusitivity agreements with a potential acquirer. It is not that uncommon to do this, in fact, I would say it is more common to not have an exclusivity agreement as part of an LOI than it would be to have one.

With multiple parties at the due diligence stage, it gives the startup CEO leverage to close a deal quickly, and to negotiate the price up. Acquirers are also reassured by the validation that other interested potential acquirers provide. If you are set on being acquired, speak to multiple companies and have them press while the iron (ie. their motivation) is hot. Always be prepared for due diligence.

<comment><USER9> It seems like the exclusivity agreement is the main issue here. Imagine if 3PAR had an exclusivity agreement with either HP or Dell, they would not be in such a good negotiating position that they can add hundreds of millions onto the price.

<comment><USER10> My understanding of what usually occurs in deals like this is that most of the price negotiations happen before LOIs are signed in the first place.

</comment></comment></comment><comment><USER11> Their post is really _really_ f'king clever...

It's a massive "hey, we're prime for being acquired - come and get us!" solicitation.

The information contained in the post is fascinating, but its a by-product. What they are really doing in a subtle and suitable way is telling the world they want to receive new offers to be acquired.

<comment><USER12> Were I an acquirer, I'd look down on such a shady posting. It seems rather manipulative and without knowing much context, I'd read it as a very inexperienced team. If you're trying to sell, there are plenty of backchannel methods to pass information to potential acquirers.

<comment><USER13> Shady and manipulative? I don't think so.

If I were a potential acquirer, I would be happy to have a window in to their decision making process.

</comment></comment></comment><comment><USER14> Great article about requiring a break-up fee in case a buyer walks away after the company has spent lots of time and money on lawyers for nothing.

The title made me think of a funny situation where every service sends an e-mail to their users whenever an acquisition fails:

Dear customer,

We regret to inform you that our company has almost been acquired. Your accounts will continue to work throughout this period of non-transition. Upon such a time we find a buyer, you will then have 30 days from the date of announcement to find an alternative.

The Management

</comment><comment><USER15> A lot of interesting offhand tidbits in it -

 _Our team has been through a few acquisitions_

So we know they were not babes wandering the woods.

But then -

They went to shop the offer which seems logical enough but seemed to believe this process can really be all that 'discreet'.

Then

 _we heard rumors that Cogswell had previous acquisition processes that started and didn't complete, which made us a bit nervous._

and

 _At the last minute, around midnight on Tuesday, Cogswell said yes [...]_

These seem like overt red flags, although, of course, they are made much more obvious with the hindsight provided by the author.

 _We called Spacely. Our contacts there were really unhappy. They wanted to do the deal, but in the months since we went silent [...]_

Ouch, months.

Long story short, if you have just two bidders of which one did not choose to bid unsolicited and maybe has a history of less than good-faith bidding, you're navigating treacherous waters. And you might end up navigating them even if you do (or think that you do) know what you're doing.

</comment><comment><USER16> On a completely different note, I'm disappointed to hear that they've been courting an acquisition. I really don't understand this -- you have a great product, happy customers, lots of growth, a solid business model, and tons of continued growth potential; why would you want to get out of that?

I've been promoting their service and gradually signing up my clients (even though, last I checked, their reseller program still wasn't active). I was hesitant at first because I wanted to be sure that my clients were getting a service which would be around for the long term. Bummer.

<comment><USER11> Why are you disappointed?

I'm not clear how 'being acquired' is some how negative?

<comment><USER17> Being acquired isn't _necessarily_ a negative, but all too often the next step after being acquired is "Hi, we've been acquired and this service is shutting down." (With a nod that they'll be back, and better than ever. Which generally doesn't turn out to be true.)

<comment><USER16> I'm generalizing here, but when someone decides to build a startup, it's usually because there is a problem that they want to solve so desperately that they're willing to forgo the comforts of a regular paycheck and having to only concentrate on one or two things a day. They're willing to endure sleepless nights, stress, uncertainty, and pour a huge amount of effort into creating something.

So, they tend to take care of their customers really well. They tend to produce the best product or service they can, and if they succeed at that, they become really popular.

Established large businesses have completely different priorities. Oracle's licensing schemes for one example are not designed for their customers' benefit; they're designed to maximize Oracle's profit, calculated in part by how many customers they can afford to lose.

In Backblaze's case, let's look at their business model: $5/month for unlimited storage per computer. This is _great_ for their customers. It solves an important problem. They even mentioned in this post that they set out to create this service after one of their friends suffered an agonizing data loss.

But, that's not the most profitable way to run the business. Oracle for example would make a _lot_ more money on it by offering it to their enterprise customers at some absurd monthly fee (plus fees for an annual support contract), and ignore the consumer market altogether, along with all of the headaches that comes from the additional data storage and support costs for supporting the consumer market.

So yeah, I'm not usually too excited by the news that some really great startup is looking to get acquired.

</comment></comment></comment></comment><comment><USER18> Don't pop the champagne until the money is in the bank.

</comment><comment><USER19> Great article about the whole acquisition process. I can't recall a more detailed account.

</comment><comment><USER20> I have never heard of this service before but it looks pretty sweet. $5 for unlimited backup storage? How on earth?

This is what they say about it on their website:

"How Can You Backup Everything Online For Just $5 per Month? We have developed a highly efficient storage system that enables us to optimize how we store data. And we're counting on some people having a lot of data and others not very much, but that it will work out on average. "

..but still. Almost sounds scary.

<comment><USER21> Without technical details on how they actually manage this (Anyone can figure out that storage is an accumulative cost) I am pretty skeptic.

At $5/month the break-even on even a VERY cheap solution is around $40GB/person.

<comment><USER22> This would be true if Backblaze were simply offering 'unlimited storage for $5/mo.' Needless to say, they're not. Rather, they offer _backup_ unlimited by size for individual computers at $5/mo. The difference is what allows them to create a profitable business.

Unlike a system that stores your cumulative history, Backblaze simply keeps copies of every file you have on you computer right now. If you delete something from your local drive, Blackblaze notices, and flags their copy for deletion in 30 days. In other words, they're in the data mirroring and recovery business, not the general archive trade (a point they make very clear in their promotional materials).

They also protect themselves from overload by limiting the drives they backup to local ones (internal or external), and explicitly excluding network drives. In other words, while the amount of data per machine is unlimited, the number of machines per account is limited very strictly. This distinction is what keeps them viable.

There is an additional limit on what they handle imposed by network speeds. Realistically, most people can't send more than 4-5 GB per day. For some, it's as low as 2-3, and if you can deliver 9-10, you're doing well. Blackblaze notes this clearly, pointing out that an initial backup can take weeks, if not months to complete.

What makes them especially awesome is that they don't expect you to wait this long to recover your data. You can download files via their website at no charge. Alternately, you can flag larger collections, have them copied to DVD, and FedEx'd for next-day delivery. And if you've got a _lot_ of stuff you need immediately, they can put up to 400 GB on a single USB drive and overnight that to you for $250.

Obviously, their proposition doesn't serve everyone. But for a certain class of customers, it's absolutely perfect.

<comment><USER23> _If you delete something from your local drive, Blackblaze notices, and flags their copy for deletion in 30 days_

So much for the "damn, I must have deleted that file; I guess I'll have to recover it from my backups" scenario.

</comment></comment></comment></comment><comment><USER24> It's a shame Backblaze don't have a Linux version, it looks like a pretty neat offering.

</comment><comment><USER25> Have used Backblaze for about a year now. It's a solid system, though I use it IN ADDITION TO a local backup on my primary machine, not INSTEAD OF one. If I had to pull files over my 'net connection to my new HDD, rather than just grabbing them from my Time Machine drive sitting on my desk...well, I would be typing this on my laptop rather than my hard-drive-failed-but-replaced desktop.

Hopefully Backblaze stays chill about being acquired, and waits for a really good offer that will allow them to keep on doing what they're doing now, except better. I'd back up with Backblaze any day over Mozy or Carbonite, the only two "big dog" competitors in the area...

</comment><comment><USER26> The key was when Cogswell upped their offer, pushing the OP away from his gut instinct to go with Spacely. Cogswell callously (and perhaps not even in its own interest) refused to let the deal drop (probably someone had intuition that a Spacely was involved). Aside from the backout and legal costs (which might be insignificant for a big company), Cogswell got to keep the option alive, at Backblaze's expense (through losing the Spacely opportunity).

This kind of shit happens constantly with big companies.

</comment><comment><USER27> On their product:

I was all set to pay up for Backblaze last week, but the GUI you use to define what's backed up has a hard-coded list of excluded directories and file extensions (!!!).

Why can't I back up /Applications/ or a .iso file?

If those files push my total backup size larger than they tolerate then that's a separate issue. Too user hostile; uninstalled the sucker.

<comment><USER28> When they do their sums they are gambling that the average amount of space per user will leave them profitable. They advertise unlimited storage rather than capped storage so they have to hedge their bets somehow.

I like their model. Your milage may vary.

</comment></comment><comment><USER29> great that they shared the story. no way to know going into one if these deals if it'll happen to you or not. yes, there were red flags, but there are almost always red flags. and when there aren't red flags, it can still go south. you see it happen with the big boys, too.

i love their user growth curve graph but wonder why it's over a year old...?

</comment><comment><USER30> I thought this was a fantastic article. Not too often do you see such a candid account of a failed acquisition.

</comment><comment><USER31> Great article. Thanks for sharing.

</comment><comment><USER21> This is almost 'trollworthy'. Hey we 'almost' got bought out, so hey try our service (Profit)

</comment><comment><USER32> Thank FSM! I LOVE my Backblaze! It's the perfect backup solution, no-foolin'.</comment>


Twitter Hacker Says Admin Password Was 'Happiness' - <AUTHOR> http://blog.wired.com/27bstroke6/2009/01/professed-twitt.html <comment><USER6> This is why ideally you only make your admin tools available on your private network, accessible only via VPN. The very minimum is restricting access to admin functionality to specific IP addresses.

Limiting password check attempts is important too, but if all a bad guy could get access to is user accounts the damage is significantly less.

<comment><USER7> Limiting attempts is a great way to allow people to remotely execute a DoS on your admin site. They can keep you out for awhile before you block them. If your company has a password lockout policy, keep guessing the CEO or CIOs password constantly for a few days and the policy will be changed pretty quickly. The other suggestions are good.

<comment><USER8> You don't lockout the account, you lockout the attacking client, typically by IP address. It still allows the attacked accounts access from non-attacking IP addresses.

<comment><USER9> and if the attacking client is someone sitting on the corporate internet? way to block the entire corp from logging in ...

<comment><USER10> It seems like the three main strategies are locking the account, blocking the IP, or forcing a password reset. What if instead, the account login name automatically got changed after a few missed attempts but the password remained the same. That would get around the DoS problem and also the corporate IP / AOL problem.

<comment><USER7> I think rate limiting is a better option. If you only allow one log in attempt per X seconds, it becomes much harder to do a dictionary attack in a reasonable amount of time.

<comment><USER11> This to me is the way to do it. You can limit it to something pretty large like even or 3 tries, wait ten seconds or something. Basically making it normal speed for a human but waaay slow for a computer is the trick to me. A dictionary attack has to try tens of thousands of words and combinations to crack an account.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> ___He also realized he hadn't used a proxy to hide his IP address, potentially making him traceable. He didn't think the intrusion was important draw for law-enforcement attention, and "didn't think it would make headlines._ __

I don't understand how he thought hi-jacking Obama, Britney and Fox News twitter accounts wouldn't make headlines.

<comment><USER13> He didn't hijack those accounts; he gave out the credentials in a forum thread and others jumped on it.

<comment><USER12> Technically you're correct, but by giving out the credentials in a public forum he should have known better.

<comment><USER13> DG is an unique place.

</comment></comment></comment></comment><comment><USER14> This is again a reason why you shouldn't make accessing internal company services too easy. Yeah, it can be a pain but once someone figures out a little piece of the puzzle, they can run amok in your network. In hindsight, tying customer service methods to employee Twitter accounts was the big mistake.

<comment><USER15> Sure was a heck of a guess to end up with a staffer.

</comment></comment><comment><USER15> This does bring up a good tech question -- how do you prevent people from doing a rapid password attack?

Anyone have an article or some ideas on how this could be done? Is limiting attempts the simplest way?

Even if you do limits, aren't these session-based? I'm guessing a cracker isn't going to respect sessions.

<comment><USER16> Presume that you have some sort of table with userIDs and password hashes (with salt). You should also consider adding some columns like:

1 - <USER2>

2 - <USER3>

3 - <USER4>

4 - <USER5>

5 - MustChagePasswordAtNextLogin - a boolean flag to indicate they must change their password. You'll set that flag when they're recovering a password, or you've emailed them a temporary password.

6 - UnsuccessfulLoginCount - some number that your logic will use to determine how long they must wait, or if they sit in the penalty box.

7 - AccountLocked - boolean flag, some pointy haired bosses will not permit accounts to be locked out, like mine. And mine refuses to allow passwords to be one-way hashes (his words: we must be able to email the user the password they use). Depending on the security you need, the user of a locked account either has to phone up an unhelp desk, or show up in person.

8 - UserAgreementID - As you change user agreements, you'll want to keep track of what agreement the user agreed to, what day and time. This is something you'll want to log, and if you make substantial changes to the user agreement, you may want to force them to re-agree to the terms of use. You will also want to keep every version of the user agreement stashed away in a table somewhere, in case the lawyers get involved.

9 - UserAgreementDateTime - see #8

Along with a LoginTransaction table that captures attempts - both successful and not to log in, with usernames, date/time, IPaddress. This table should locked down so that a hacker can't delete entries, entries can be added, but not deleted nor changed. You'll do that with triggers ("instead of" triggers for sql server folks).

Perhaps your business logic says that a user can have 3 attempts in a 5 minute window (with no lockouts).

Your code would do something like...user has made 3rd bad attempts, set LastLoginAttemptedDateTime = Now, set UnsuccessfulLoginCount = 3.

Now the user tries to log in 1 minute later...If LastLoginAttemptedDateTime + 5_minutes < Now then log the attempt, LastLoginAttemptedDateTime = Now, reject login attempt EndIf.

If they log in successfully, log that event, set UnsuccessfulLoginCount = 0, set LastSuccessfulLoginDateTime and LastSuccessfulLoginIPAddress to the appropriate values.

<comment><USER17> And if the attacker doesn't care _which_ userID they compromise, so they spread their guesses over all userIDs?

<comment><USER18> This is a very real concern, however it is significantly less likely for such a horizontal attack to succeed. I recommend the grand parent post's solution for startups who aren't yet approaching critical mass and only require protection from the vertical.

Small user sets, such as the Twitter admin accounts, would not be large enough to be successful with a horizontal attack. Provided, of course, that every user has a minimum password complexity, which they did not. Even without complexity requirements, the list of simple words is still prohibitively large in most cases.

That said, if you have even one user among millions with the password "qwerty", he is certainly at risk. However, once you are at a scale prone to this kind of attack, a more sophisticated rate limiting scheme is probably required even for regular web requests.

</comment></comment></comment></comment><comment><USER19> "He said he'd never even heard of Twitter until he saw someone mention it on YouTube."

Classic

<comment><USER20> Unsurprising. Most people have no idea what Twitter is.

I've noticed sometimes the tech world feels like a bubble where our sense of what's important in the "real world" gets warped.

</comment></comment><comment><USER15> Again, it brings up the case of why passwords are bad at this level.

Maybe staffers should have used a secondary password to get administrative rights.

Or maybe they should have been using an entirely different account.

<comment><USER16> Admin accounts should not use the main website for access - they should only have access through an admin website.

If you must let admin accounts use the main website, then they should have a whitelist of IP addresses that they may log in from - and those IP addresses should map to the internal company IP addresses.

Otherwise, if you absolutely positively MUST have admin accounts use the same website, and allow them access from outside the company, then you need to have a second factor authentication device like a SecurID token.

</comment></comment><comment><USER21> <http://www.youtube.com/watch?v=qEZxgEgG5Cg#t=1m52s>

</comment><comment><USER22> No, it wasn't. "Happiness" was the password for the account of a user who happened to be on the support staff.

</comment><comment><USER23> we're all human, and twitter is very new.

We all make mistakes, doesn't seem terrible honestly.

</comment><comment><USER24> weak</comment>